<p>Your email got me a little but confused.</p>
<p>If the Ldaploginmodule is already adding a role to the principal then it will be a custom principal regardless of whether I retrieve that data from it or not, no?</p>
<p>It's not about being an issue or not to do an extra ldap connection but more of an optimization thing since one less connection is always better.</p>
<p>Regarding your last sentence, are you saying that the functionality of commiting a role exists solely for the purpose of making it harder to serialize the authentication result (which I am guessing, if so, is a security feature)?</p>
<div class="gmail_quote">On Jun 20, 2013 7:10 PM, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 6/20/13 12:06 PM, "Byte Flinger" <<a href="mailto:byteflinger@gmail.com">byteflinger@gmail.com</a>> wrote:<br>
<br>
>Hi Christopher<br>
>Thanks for the answer. As mentioned, I did indeed manage to get the<br>
>wanted information using an LDAP DataConnector however given that the<br>
>role seems to be already returned by the login module, fast or not, it's<br>
>still a waste to have to make yet another connection<br>
> for information that's already been retrieved.<br>
<br>
That's how it should be done.<br>
<br>
>Trying to get the info out of the principal is exactly what I have been<br>
>trying to do (among other ways) however so far I have had no luck.<br>
<br>
You can, but don't. There are reasons why that will become a more<br>
complicated thing to do. Using custom principal objects causes problems<br>
for the storage of sessions and going forward that is not something you<br>
want to be relying on. If a few extra queries is noticeable to your IdP,<br>
you have something wrong on the back-end LDAP.<br>
<br>
>If this is not possible, what is the use of the role parameters in the<br>
>Ldaploginmodule anyway since it works to login without it (The module<br>
>simply won't "commit" any roles, whatever that means).<br>
<br>
That's a JAAS concept. It makes it impossible to reliably serialize the<br>
result of the authenticaton without adding custom code.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>